Remote Code Execution. When importing from VaultWiki 3 or 4 and using the undocumented $api_path capability: if the DNS is compromised, or if the remote server is compromised, the compromised server may be able to execute commands against the server running VaultWiki. Does not affect Lite versions.